CVE-2022-47940

An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18. fs/ksmbd/smb2pdu.c lacks length validation in the non-padding case in smb2write...

Authorization Bypass

github.com/openfga/openfga is vulnerable to authorization bypass. The vulnerability exists in the readUserTuple function in checkutils.go due to the lack of validation in authorization mechanism which allows an attacker to bypass the authorization mechanism under certain conditions...

CVE-2022-4107: Undefined Security Weakness

The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server...

Sharp Digital Full-color Multifunctional System 命令注入漏洞

The Sharp Digital Full-color Multifunctional System is a series of digital full-color multifunctional printers from Sharp, Japan. A command injection vulnerability exists in the Sharp Digital Full-color Multifunctional System, which is not properly protected with a strong administrator password a...

Cross-site Scripting (XSS)

github.com/alist-org/alist is vulnerable to cross-site scripting. The vulnerability exists due to lack of sanitization in useradmin page which allows a remote attacker to inject and execute malicious javascript on the system...

CVE-2022-3908: Undefined Security Weakness

The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

PT-2022-24971

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce WordPress plugin versions prior to 2.8.4 Description The issue concerns a lack of authorization and CSRF protection in an AJAX action. This allows any logged-in user to create, update, and delete shipping methods...

PT-2022-24149

Name of the Vulnerable Software and Affected Versions Aruba AirWave Management Platform versions 8.2.15.0 and below Description The issue concerns a lack of proper access controls in the web-based management interface of the AirWave Management Platform, potentially allowing a remote attacker with...

Tenda AC6 buffer overflow vulnerability (CNVD-2026-38725)

The Tenda AC6 is a dual-band gigabit wireless router launched by Tenda. The Tenda AC6 has a buffer overflow vulnerability, which stems from the lack of length validation for the time parameter in the fromSetSysTime function. Attackers can exploit this vulnerability to cause a denial-of-service...

多款Kyocera产品安全漏洞

The Kyocera ECOSYS Series and Kyocera FS Series are both a series of printers from Kyocera, Japan. A security vulnerability exists in the Kyocera MFP 4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN versions, which stems from a lack of authorization, and which can be exploited ...

PT-2022-10125 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about a specific vulnerability. It appears to be a notification about a rejected CVE candidate...

PT-2022-8746 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about a specific vulnerability. It appears to be a notification about a rejected candidate...

NetIQ Advanced Authentication 授权问题漏洞

NetIQ Advanced Authentication is an application from NetIQ UK. It provides a shift from usernames and passwords to a more secure way of protecting your sensitive information. A security vulnerability exists in NetIQ Advanced Authentication that stems from a lack of authentication...

PT-2022-27682 · Unknown · Esl Protocol

Name of the Vulnerable Software and Affected Versions: ESL protocol versions affected versions not specified Description: The issue concerns the lack of authentication in the ESL protocol, which can be exploited by attackers to change label values using 433 MHz RF signals. This has been...

Electronic Shelf Label 安全漏洞

Electronic Shelf Tags Electronic Shelf Label is a digital label management software from Electronic Shelf Tags, Inc. A security vulnerability exists in the Electronic Shelf Label protocol that stems from its lack of authentication, which allows an attacker to change the value of a label via a 433...

CVE-2022-0421

The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping,...

Upgraded Q -> M from #164 [1668687728737]

Judge has assessed an item in Issue 164 as M risk. The relevant finding follows: 01 Lack of check if dust ether transfer is successful --- The text was updated successfully, but these errors were encountered: All reactions...

Default credentials

An issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of authentication, unauthenticated attackers can complete the password-reset process for any account and set a new password...

CVE-2022-3574 WPForms Pro < 1.7.7 - CSV Injection

The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection...

PT-2022-35256

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.75 Description The issue concerns a lack of bounds check on the Transfer Tag in nvmet-tcp. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior...